[gentoo-commits] proj/hardened-refpolicy:master commit in: policy/modules/contrib/

[Sven Vermeulen]

commit:     feb423dabdacb8a9a5e639f8d715e20aa3d8d4f2
Author:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
AuthorDate: Thu Nov  1 20:20:45 2012 +0000
Commit:     Sven Vermeulen <sven.vermeulen <AT> siphos <DOT> be>
CommitDate: Thu Nov  1 20:20:45 2012 +0000
URL:        http://git.overlays.gentoo.org/gitweb/?p=proj/hardened-refpolicy.git;a=commit;h=feb423da

Further reshuffle additions into their own ifdef group

---
 policy/modules/contrib/mozilla.te |  197 +++++++++++++++++++------------------
 1 files changed, 103 insertions(+), 94 deletions(-)

diff --git a/policy/modules/contrib/mozilla.te b/policy/modules/contrib/mozilla.te
index fca9e78..074676e 100644
--- a/policy/modules/contrib/mozilla.te
+++ b/policy/modules/contrib/mozilla.te
@@ -99,7 +99,6 @@ allow mozilla_t self:sem create_sem_perms;
 allow mozilla_t self:socket create_socket_perms;
 allow mozilla_t self:unix_stream_socket { accept listen };
 
-allow mozilla_t mozilla_plugin_t:process { rlimitinh siginh noatsecure };
 allow mozilla_t mozilla_plugin_t:unix_stream_socket rw_socket_perms;
 allow mozilla_t mozilla_plugin_t:fd use;
 
@@ -114,7 +113,6 @@ userdom_user_home_dir_filetrans(mozilla_t, mozilla_home_t, dir, ".phoenix")
 filetrans_pattern(mozilla_t, mozilla_home_t, mozilla_plugin_home_t, dir, "plugins")
 
 manage_files_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t)
-manage_fifo_files_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t)
 manage_dirs_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t)
 files_tmp_filetrans(mozilla_t, mozilla_tmp_t, { file dir })
 
@@ -131,9 +129,9 @@ allow mozilla_t mozilla_plugin_rw_t:lnk_file read_lnk_file_perms;
 stream_connect_pattern(mozilla_t, mozilla_plugin_tmpfs_t, mozilla_plugin_tmpfs_t, mozilla_plugin_t)
 
 kernel_read_kernel_sysctls(mozilla_t)
-kernel_read_net_sysctls(mozilla_t)
 kernel_read_network_state(mozilla_t)
 kernel_read_system_state(mozilla_t)
+kernel_read_net_sysctls(mozilla_t)
 
 corecmd_list_bin(mozilla_t)
 corecmd_exec_shell(mozilla_t)
@@ -144,9 +142,6 @@ corenet_all_recvfrom_netlabel(mozilla_t)
 corenet_tcp_sendrecv_generic_if(mozilla_t)
 corenet_tcp_sendrecv_generic_node(mozilla_t)
 
-corenet_dontaudit_tcp_bind_generic_port(mozilla_t)
-corenet_dontaudit_tcp_sendrecv_generic_port(mozilla_t)
-
 corenet_sendrecv_http_client_packets(mozilla_t)
 corenet_tcp_connect_http_port(mozilla_t)
 corenet_tcp_sendrecv_http_port(mozilla_t)
@@ -175,10 +170,6 @@ corenet_sendrecv_speech_client_packets(mozilla_t)
 corenet_tcp_connect_speech_port(mozilla_t)
 corenet_tcp_sendrecv_speech_port(mozilla_t)
 
-corenet_sendrecv_tor_client_packets(mozilla_t)
-corenet_tcp_connect_tor_port(mozilla_t)
-corenet_tcp_sendrecv_tor_port(mozilla_t)
-
 dev_getattr_sysfs_dirs(mozilla_t)
 dev_read_sound(mozilla_t)
 dev_read_rand(mozilla_t)
@@ -210,17 +201,88 @@ miscfiles_read_fonts(mozilla_t)
 miscfiles_read_localization(mozilla_t)
 miscfiles_dontaudit_setattr_fonts_dirs(mozilla_t)
 
-userdom_search_user_home_dirs(mozilla_t)
 userdom_use_user_ptys(mozilla_t)
 
 mozilla_run_plugin(mozilla_t, mozilla_roles)
 mozilla_run_plugin_config(mozilla_t, mozilla_roles)
 
-xdg_manage_downloads_home(mozilla_t)
-
-xserver_dontaudit_getattr_xdm_tmp_sockets(mozilla_t)
-xserver_dontaudit_read_xdm_tmp_files(mozilla_t)
 xserver_user_x_domain_template(mozilla, mozilla_t, mozilla_tmpfs_t)
+xserver_dontaudit_read_xdm_tmp_files(mozilla_t)
+xserver_dontaudit_getattr_xdm_tmp_sockets(mozilla_t)
+
+ifdef(`distro_gentoo',`
+	allow mozilla_t mozilla_plugin_t:process { rlimitinh siginh noatsecure };
+
+	manage_fifo_files_pattern(mozilla_t, mozilla_tmp_t, mozilla_tmp_t)
+
+	corenet_dontaudit_tcp_bind_generic_port(mozilla_t)
+	corenet_dontaudit_tcp_sendrecv_generic_port(mozilla_t)
+	corenet_sendrecv_tor_client_packets(mozilla_t)
+	corenet_tcp_connect_tor_port(mozilla_t)
+	corenet_tcp_sendrecv_tor_port(mozilla_t)
+
+	userdom_search_user_home_dirs(mozilla_t)
+
+	xdg_manage_downloads_home(mozilla_t)
+	xdg_read_generic_config_home_files(mozilla_t)
+	xdg_read_generic_data_home_files(mozilla_t)
+
+	#xserver_common_x_domain_template(mozilla_t, mozilla_tmpfs_t) is this
+	#not better than user_x_domain_template ?
+
+	# main refpolicy does not make this distinction anymore
+	# (allows manage rights automatically)
+	tunable_policy(`mozilla_read_user_content',`
+		userdom_list_user_tmp(mozilla_t)
+		userdom_read_user_home_content_files(mozilla_t)
+		userdom_read_user_home_content_symlinks(mozilla_t)
+		userdom_read_user_tmp_files(mozilla_t)
+		userdom_read_user_tmp_symlinks(mozilla_t)
+	
+		ifndef(`enable_mls',`
+			fs_list_dos(mozilla_t)
+			fs_read_dos_files(mozilla_t)
+			fs_read_iso9660_files(mozilla_t)
+			fs_read_removable_files(mozilla_t)
+			fs_read_removable_symlinks(mozilla_t)
+			fs_search_removable(mozilla_t)
+		')
+	',`
+		files_dontaudit_list_home(mozilla_t)
+		files_dontaudit_list_tmp(mozilla_t)
+	
+		fs_dontaudit_list_removable(mozilla_t)
+		fs_dontaudit_read_removable_files(mozilla_t)
+	
+		userdom_dontaudit_list_user_home_dirs(mozilla_t)
+		userdom_dontaudit_list_user_tmp(mozilla_t)
+		userdom_dontaudit_read_user_home_content_files(mozilla_t)
+		userdom_dontaudit_read_user_tmp_files(mozilla_t)
+	')
+
+	optional_policy(`
+		tunable_policy(`mozilla_use_java',`
+			#java_noatsecure_domtrans(mozilla_t)
+			# refpolicy method below, but we might want to introduce
+			# specific domains for this (like mozilla_java_t)? TODO
+			java_exec(mozilla_t)
+			java_manage_generic_home_content(mozilla_t)
+		')
+		
+		java_home_filetrans_java_home(mozilla_t, dir, ".java")
+	
+		# Cannot handle optional_policy within tunable_policy
+		optional_policy(`
+			tunable_policy(`mozilla_use_java',`
+				chromium_tmp_filetrans(mozilla_t, mozilla_tmp_t, fifo_file)
+			')
+		')
+	')
+
+	optional_policy(`
+		nscd_socket_use(mozilla_t)
+	')
+')
 
 tunable_policy(`allow_execmem',`
 	allow mozilla_t self:process execmem;
@@ -242,36 +304,6 @@ tunable_policy(`use_samba_home_dirs',`
 	fs_manage_cifs_symlinks(mozilla_t)
 ')
 
-# Specific for Gentoo, main refpolicy does not make this distinction anymore
-# (allows manage rights automatically)
-tunable_policy(`mozilla_read_user_content',`
-	userdom_list_user_tmp(mozilla_t)
-	userdom_read_user_home_content_files(mozilla_t)
-	userdom_read_user_home_content_symlinks(mozilla_t)
-	userdom_read_user_tmp_files(mozilla_t)
-	userdom_read_user_tmp_symlinks(mozilla_t)
-
-	ifndef(`enable_mls',`
-		fs_list_dos(mozilla_t)
-		fs_read_dos_files(mozilla_t)
-		fs_read_iso9660_files(mozilla_t)
-		fs_read_removable_files(mozilla_t)
-		fs_read_removable_symlinks(mozilla_t)
-		fs_search_removable(mozilla_t)
-	')
-',`
-	files_dontaudit_list_home(mozilla_t)
-	files_dontaudit_list_tmp(mozilla_t)
-
-	fs_dontaudit_list_removable(mozilla_t)
-	fs_dontaudit_read_removable_files(mozilla_t)
-
-	userdom_dontaudit_list_user_home_dirs(mozilla_t)
-	userdom_dontaudit_list_user_tmp(mozilla_t)
-	userdom_dontaudit_read_user_home_content_files(mozilla_t)
-	userdom_dontaudit_read_user_tmp_files(mozilla_t)
-')
-
 optional_policy(`
 	apache_read_user_scripts(mozilla_t)
 	apache_read_user_content(mozilla_t)
@@ -314,25 +346,6 @@ optional_policy(`
 ')
 
 optional_policy(`
-	tunable_policy(`mozilla_use_java',`
-		#java_noatsecure_domtrans(mozilla_t)
-		# refpolicy method below, but we might want to introduce
-		# specific domains for this (like mozilla_java_t)? TODO
-		java_exec(mozilla_t)
-		java_manage_generic_home_content(mozilla_t)
-	')
-	
-	java_home_filetrans_java_home(mozilla_t, dir, ".java")
-
-	# Cannot handle optional_policy within tunable_policy
-	optional_policy(`
-		tunable_policy(`mozilla_use_java',`
-			chromium_tmp_filetrans(mozilla_t, mozilla_tmp_t, fifo_file)
-		')
-	')
-')
-
-optional_policy(`
 	lpd_run_lpr(mozilla_t, mozilla_roles)
 ')
 
@@ -343,10 +356,6 @@ optional_policy(`
 ')
 
 optional_policy(`
-	nscd_socket_use(mozilla_t)
-')
-
-optional_policy(`
 	pulseaudio_role(mozilla_roles, mozilla_t)
 ')
 
@@ -354,11 +363,6 @@ optional_policy(`
 	thunderbird_domtrans(mozilla_t)
 ')
 
-optional_policy(`
-	xdg_read_generic_config_home_files(mozilla_t)
-	xdg_read_generic_data_home_files(mozilla_t)
-')
-
 ########################################
 #
 # Plugin local policy
@@ -367,12 +371,10 @@ optional_policy(`
 dontaudit mozilla_plugin_t self:capability { ipc_lock sys_nice sys_ptrace sys_tty_config };
 allow mozilla_plugin_t self:process { setpgid getsched setsched signal_perms setrlimit };
 allow mozilla_plugin_t self:fifo_file manage_fifo_file_perms;
-allow mozilla_plugin_t self:netlink_route_socket r_netlink_socket_perms;
 allow mozilla_plugin_t self:netlink_kobject_uevent_socket create_socket_perms;
 allow mozilla_plugin_t self:sem create_sem_perms;
 allow mozilla_plugin_t self:shm create_shm_perms;
 allow mozilla_plugin_t self:tcp_socket { accept listen };
-allow mozilla_plugin_t self:udp_socket create_socket_perms;
 allow mozilla_plugin_t self:unix_dgram_socket sendto;
 allow mozilla_plugin_t self:unix_stream_socket { accept connectto listen };
 
@@ -466,10 +468,6 @@ corenet_sendrecv_monopd_client_packets(mozilla_plugin_t)
 corenet_tcp_connect_monopd_port(mozilla_plugin_t)
 corenet_tcp_sendrecv_monopd_port(mozilla_plugin_t)
 
-corenet_sendrecv_pulseaudio_client_packets(mozilla_plugin_t)
-corenet_tcp_connect_pulseaudio_port(mozilla_plugin_t)
-corenet_tcp_sendrecv_pulseaudio_port(mozilla_plugin_t)
-
 corenet_sendrecv_soundd_client_packets(mozilla_plugin_t)
 corenet_tcp_connect_soundd_port(mozilla_plugin_t)
 corenet_tcp_sendrecv_soundd_port(mozilla_plugin_t)
@@ -521,16 +519,36 @@ auth_use_nsswitch(mozilla_plugin_t)
 
 logging_send_syslog_msg(mozilla_plugin_t)
 
-miscfiles_dontaudit_setattr_fonts_cache_dirs(mozilla_plugin_t)
-miscfiles_dontaudit_setattr_fonts_dirs(mozilla_plugin_t)
+miscfiles_read_localization(mozilla_plugin_t)
 miscfiles_read_fonts(mozilla_plugin_t)
 miscfiles_read_generic_certs(mozilla_plugin_t)
-miscfiles_read_localization(mozilla_plugin_t)
 
-userdom_dontaudit_use_user_terminals(mozilla_plugin_t)
-userdom_rw_user_tmpfs_files(mozilla_plugin_t)
+ifdef(`distro_gentoo',`
+	allow mozilla_plugin_t self:netlink_route_socket r_netlink_socket_perms;
+	allow mozilla_plugin_t self:udp_socket create_socket_perms;
 
-xserver_user_x_domain_template(mozilla_plugin, mozilla_plugin_t, mozilla_plugin_tmpfs_t)
+	corenet_sendrecv_pulseaudio_client_packets(mozilla_plugin_t)
+	corenet_tcp_connect_pulseaudio_port(mozilla_plugin_t)
+	corenet_tcp_sendrecv_pulseaudio_port(mozilla_plugin_t)
+
+	miscfiles_dontaudit_setattr_fonts_cache_dirs(mozilla_plugin_t)
+	miscfiles_dontaudit_setattr_fonts_dirs(mozilla_plugin_t)
+
+	userdom_dontaudit_use_user_terminals(mozilla_plugin_t)
+	userdom_rw_user_tmpfs_files(mozilla_plugin_t)
+
+	xdg_read_generic_config_home_files(mozilla_plugin_t)
+
+	xserver_user_x_domain_template(mozilla_plugin, mozilla_plugin_t, mozilla_plugin_tmpfs_t)
+
+	optional_policy(`
+		alsa_domain(mozilla_plugin_t, mozilla_plugin_tmpfs_t)
+	')
+
+	optional_policy(`
+		flash_manage_home(mozilla_plugin_t)
+	')
+')
 
 tunable_policy(`allow_execmem',`
 	allow mozilla_plugin_t self:process execmem;
@@ -554,7 +572,6 @@ tunable_policy(`use_samba_home_dirs',`
 
 optional_policy(`
 	alsa_read_rw_config(mozilla_plugin_t)
-	alsa_domain(mozilla_plugin_t, mozilla_plugin_tmpfs_t)
 	alsa_read_home_files(mozilla_plugin_t)
 ')
 
@@ -569,10 +586,6 @@ optional_policy(`
 ')
 
 optional_policy(`
-	flash_manage_home(mozilla_plugin_t)
-')
-
-optional_policy(`
 	gnome_manage_generic_home_content(mozilla_plugin_t)
 	gnome_home_filetrans_gnome_home(mozilla_plugin_t, dir, ".gnome")
 	gnome_home_filetrans_gnome_home(mozilla_plugin_t, dir, ".gnome2")
@@ -608,10 +621,6 @@ optional_policy(`
 ')
 
 optional_policy(`
-	xdg_read_generic_config_home_files(mozilla_plugin_t)
-')
-
-optional_policy(`
 	xserver_read_user_xauth(mozilla_plugin_t)
 	xserver_read_xdm_pid(mozilla_plugin_t)
 	xserver_stream_connect(mozilla_plugin_t)